Digital Trade and Data Localisation Laws: A Comparative Analysis of South Africa, India and the European Union

Introduction

The digital economy has transformed international trade by enabling the seamless movement of goods, services, and information across national borders. Cross-border data flows now underpin global commerce, facilitating e-commerce, cloud computing, digital financial services, and international supply chains. According to the World Trade Organization (WTO), digital trade has become one of the fastest-growing sectors of the global economy, contributing significantly to economic development and innovation. However, as governments increasingly seek to regulate data for reasons of privacy, cybersecurity, and national security, tensions have emerged between promoting free trade and protecting domestic interests.

One of the most controversial regulatory measures adopted by states is data localisation, which refers to legal requirements compelling businesses to store or process data within a country’s territorial borders. Proponents argue that localisation enhances national security, strengthens data protection, and improves governmental oversight. Critics, however, contend that such measures create barriers to international trade, increase compliance costs for multinational enterprises, and restrict the free flow of information that is essential to the digital economy. These competing interests have generated significant legal uncertainty within international trade law.

Although international agreements such as the General Agreement on Trade in Services (GATS) and ongoing WTO negotiations seek to facilitate cross-border digital commerce, there remains no universally accepted legal framework governing data localisation. Consequently, individual jurisdictions have adopted divergent regulatory approaches. The European Union prioritises robust personal data protection through the General Data Protection Regulation (GDPR), India has introduced an evolving framework balancing digital sovereignty with economic growth, while South Africa has implemented privacy protections through the Protection of Personal Information Act (POPIA) within its broader constitutional framework.

This article argues that the absence of harmonised international standards governing data localisation creates legal fragmentation that undermines digital trade while simultaneously encouraging states to pursue legitimate public policy objectives. It is submitted that a balanced international framework is required to reconcile data protection, national security, and the principles of free trade.

The article proceeds as follows. Section II examines the international legal framework governing digital trade and cross-border data flows. Section III analyses the domestic legal approaches adopted by South Africa, India, and the European Union. Section IV evaluates relevant judicial decisions and international legal developments. Section V critically assesses the effectiveness of existing regulatory models and identifies the challenges they present for international commerce. Finally, Section VI proposes legal reforms aimed at achieving greater consistency in international digital trade regulation before concluding the discussion.

International Legal Framework Governing Digital Trade

The Evolution of Digital Trade

Digital trade refers to commercial activities conducted through electronic means, including the cross-border exchange of goods, services, digital content, and data. Unlike traditional trade, digital commerce depends heavily upon the unrestricted movement of information between jurisdictions. Businesses increasingly rely on cloud computing, artificial intelligence, online payment systems, and digital communication platforms to facilitate international transactions. Consequently, restrictions on cross-border data transfers may significantly affect international investment, innovation, and economic competitiveness.

International trade law historically developed to regulate physical goods crossing national borders. However, technological advancements have required legal institutions to reconsider whether existing trade agreements adequately address the unique characteristics of the digital economy. Data has emerged as a strategic economic resource comparable to capital and labour, making its regulation central to contemporary international trade policy.

The World Trade Organization and Digital Commerce

The WTO remains the principal institution governing international trade. Although its agreements predate the emergence of modern digital commerce, several provisions remain relevant to cross-border data flows.

The General Agreement on Trade in Services (GATS) establishes legal obligations relating to international trade in services, including telecommunications, financial services, and information technology. Under GATS, member states undertake commitments to avoid unnecessary discrimination against foreign service suppliers and to promote market access. Nevertheless, GATS also permits governments to adopt measures necessary to protect public morals, public order, privacy, and national security, provided such measures are not applied arbitrarily or constitute disguised restrictions on trade.

This balance creates significant legal ambiguity. States frequently justify data localisation requirements as necessary for protecting privacy or safeguarding national security. Conversely, affected businesses argue that these requirements impose unjustifiable barriers inconsistent with international trade obligations. Because WTO jurisprudence has not yet comprehensively addressed mandatory data localisation, considerable uncertainty remains regarding the legality of such measures under existing trade law.

Recognising these challenges, WTO members launched the Joint Statement Initiative on Electronic Commerce, seeking to establish updated international rules governing digital trade. Negotiations continue regarding electronic contracts, online consumer protection, source code disclosure, cybersecurity cooperation, and cross-border data transfers. Although progress has been made, consensus remains difficult because participating states maintain differing priorities regarding privacy protection, digital sovereignty, and market liberalisation.

International Trade Agreements Beyond the WTO

Several regional and plurilateral trade agreements have adopted more detailed provisions governing digital trade than those currently available under the WTO framework.

The Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP) generally prohibits unjustified restrictions on cross-border data transfers while limiting mandatory data localisation requirements. Similarly, the Digital Economy Partnership Agreement (DEPA) promotes interoperability between national digital regulatory systems, encouraging cooperation in areas such as digital identities, artificial intelligence, cybersecurity, and trusted data-sharing mechanisms.

These agreements reflect an emerging international consensus favouring the free movement of data while recognising limited exceptions for legitimate public policy objectives. Nevertheless, these instruments bind only participating states and therefore do not establish universally applicable international legal standards.

Data Localisation as an Emerging Legal Challenge

Data localisation represents one of the most contentious issues within international economic law. Governments increasingly argue that domestic storage requirements enhance law enforcement capabilities, protect citizens’ personal information, and reduce dependence upon foreign technology providers. Such arguments have gained prominence following concerns relating to cybercrime, foreign surveillance, and geopolitical tensions affecting global technology markets.

However, mandatory localisation also imposes substantial economic costs. Businesses operating across multiple jurisdictions must invest in separate data centres, duplicate technological infrastructure, and navigate inconsistent regulatory requirements. Small and medium-sized enterprises may be disproportionately affected because they lack the financial resources necessary to comply with divergent national legal frameworks. Furthermore, inconsistent localisation laws may discourage foreign direct investment and reduce participation in international digital markets.

The resulting conflict illustrates the broader challenge confronting international trade law: balancing state sovereignty and regulatory autonomy against the economic benefits of an open, integrated digital marketplace. This tension provides the foundation for the comparative analysis that follows in the next section, examining how South Africa, India, and the European Union have attempted to regulate cross-border data flows while pursuing their respective economic and constitutional objectives. III. Comparative Legal Framework: South Africa, India and the European Union

South Africa’s Legal Framework

South Africa’s regulation of personal data and digital trade is primarily governed by the Protection of Personal Information Act 4 of 2013 (POPIA), which came fully into force in July 2021. POPIA gives effect to the constitutional right to privacy under section 14 of the Constitution of the Republic of South Africa, 1996, by establishing rules for the lawful processing of personal information by both public and private bodies.

Unlike some jurisdictions, South Africa has not adopted comprehensive mandatory data localisation laws. Instead, POPIA permits the transfer of personal information outside South Africa where certain safeguards exist. Section 72 allows international transfers where the receiving country provides an adequate level of data protection, where the data subject has consented, or where the transfer is necessary for the performance of a contract or another recognised legal obligation.

This approach reflects an attempt to balance privacy protection with participation in the global digital economy. South Africa recognises that unrestricted international data transfers are essential for international banking, cloud computing, online retail, and cross-border investment. At the same time, POPIA imposes accountability obligations on organisations processing personal information to ensure that individuals’ constitutional rights are protected regardless of where their information is processed.

However, certain weaknesses remain. POPIA does not establish detailed rules specifically regulating digital trade or artificial intelligence, nor does it provide comprehensive guidance regarding emerging technologies such as cross-border cloud infrastructure. Businesses often rely on contractual safeguards, creating uncertainty regarding compliance when operating across multiple jurisdictions.

From an international trade perspective, South Africa’s relatively flexible regulatory model may encourage foreign investment by avoiding strict localisation requirements. Nevertheless, the absence of detailed digital trade legislation could also reduce legal certainty for multinational corporations seeking predictable regulatory standards.

India’s Digital Regulatory Framework

India has adopted a significantly different approach, reflecting its broader objective of promoting digital sovereignty. Rapid technological growth, increasing internet penetration, and concerns regarding foreign control over citizens’ data have encouraged the Indian government to strengthen domestic regulation of digital information.

The enactment of the Digital Personal Data Protection Act 2023 represents a major development in India’s data governance framework. The Act establishes comprehensive rules governing the collection, processing, storage, and transfer of personal data while granting individuals enhanced rights over their personal information.

Unlike earlier legislative proposals advocating extensive mandatory localisation, the current framework adopts a more flexible model. The Central Government retains authority to restrict transfers to specified jurisdictions where national security or public interest concerns arise. Consequently, India seeks to preserve governmental control over strategically important data without imposing blanket localisation obligations on all businesses.

India’s policy reflects broader economic and geopolitical considerations. By encouraging domestic data infrastructure and cloud computing services, policymakers aim to stimulate local technological development while reducing dependence upon foreign digital platforms. At the same time, India continues to participate actively in international digital trade negotiations, recognising that excessive restrictions could discourage foreign investment and impede economic growth.

Critics argue, however, that uncertainty regarding future restrictions may create compliance challenges for multinational businesses. Investors require predictable legal environments when making long-term commercial decisions, and regulatory discretion may increase operational risks.

Consequently, India’s framework illustrates the ongoing tension between national sovereignty and international economic integration. Although the legislation strengthens domestic regulatory capacity, questions remain regarding its compatibility with future international digital trade obligations.

The European Union’s Regulatory Framework

Among the jurisdictions considered in this article, the European Union possesses the most sophisticated and influential regulatory framework governing cross-border data protection.

The General Data Protection Regulation (GDPR), which entered into force in 2018, establishes uniform standards governing the processing of personal data throughout the European Union. The GDPR does not prohibit international data transfers outright. Instead, it permits transfers where adequate legal protections exist, including adequacy decisions issued by the European Commission, Standard Contractual Clauses, or Binding Corporate Rules adopted by multinational enterprises.

The GDPR has significantly influenced global privacy regulation. Numerous jurisdictions, including South Africa, Brazil, Japan, and several African states, have adopted legislation reflecting similar principles of accountability, transparency, purpose limitation, and data subject rights.

Beyond privacy regulation, the European Union has introduced complementary legislation, including the Digital Markets Act, the Digital Services Act, and the Data Governance Act. Collectively, these instruments seek to enhance competition, regulate dominant digital platforms, facilitate trustworthy data sharing, and strengthen the European digital single market.

Unlike protectionist localisation measures, the European approach generally permits international data transfers provided adequate safeguards exist. This model recognises that digital trade depends upon international cooperation while maintaining high standards of individual privacy protection.

Nevertheless, the European framework has attracted criticism. Compliance costs associated with GDPR obligations can be substantial, particularly for small businesses operating internationally. Furthermore, the complexity of transfer mechanisms has generated uncertainty for multinational corporations, especially following judicial decisions invalidating previous arrangements governing transfers between Europe and the United States.

Comparative Judicial Developments and Legal Analysis

Judicial interpretation has significantly influenced the regulation of cross-border data transfers, particularly within the European Union.

One of the most influential decisions is Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems (Schrems II). In this landmark judgment, the Court of Justice of the European Union invalidated the EU–US Privacy Shield framework, holding that United States surveillance laws did not provide protections equivalent to those guaranteed under the GDPR and the Charter of Fundamental Rights of the European Union.

The judgment fundamentally altered international digital commerce. Thousands of multinational companies were required to reassess their international data transfer mechanisms, increasing legal compliance costs while demonstrating the judiciary’s growing influence over global digital trade.

Although South African courts have not yet produced equivalent jurisprudence concerning international data transfers, constitutional decisions recognising privacy as a fundamental right provide a strong foundation for future judicial interpretation of POPIA. Courts are likely to balance constitutional rights with commercial realities as digital trade disputes become more common.

Similarly, India’s courts have increasingly recognised informational privacy as a constitutional value. The Supreme Court’s landmark decision in Justice K.S. Puttaswamy (Retd.) v Union of India established privacy as a fundamental constitutional right. Although the decision concerned constitutional interpretation rather than international trade, it has significantly influenced subsequent legislative developments concerning digital regulation and data governance.

The comparative experience reveals important differences in judicial philosophy. European courts have adopted a rights-centred approach emphasising individual privacy even where commercial interests may be adversely affected. India has increasingly incorporated constitutional privacy protections while maintaining greater governmental discretion in matters affecting national security. South Africa adopts an intermediate position, seeking to balance constitutional rights with economic participation in global digital markets.

These differing approaches demonstrate that no universally accepted legal model currently exists. Instead, each jurisdiction reflects distinct constitutional traditions, economic priorities, and regulatory philosophies. The absence of harmonisation creates compliance challenges for multinational businesses while highlighting the continuing evolution of international digital trade law. Critical Evaluation

The comparative analysis demonstrates that the regulation of cross-border data flows remains fragmented despite the increasing interconnectedness of the global digital economy. Although South Africa, India, and the European Union all recognise the importance of protecting personal data, they pursue this objective through different legal mechanisms that reflect their constitutional values, economic priorities, and national security concerns. These differences create legal uncertainty for multinational corporations engaged in international trade and complicate compliance with multiple regulatory regimes.

The European Union has undoubtedly established the most comprehensive framework for data protection through the GDPR. Its emphasis on transparency, accountability, and individual rights has significantly influenced global privacy legislation. However, the GDPR’s stringent compliance obligations have also attracted criticism for imposing substantial administrative and financial burdens on businesses, particularly small and medium-sized enterprises. The invalidation of international transfer mechanisms such as the Privacy Shield further illustrates how judicial decisions can disrupt international commerce, even where businesses have attempted to comply with existing legal requirements.

India’s approach reflects a different policy objective. By emphasising digital sovereignty and governmental oversight, India seeks to strengthen domestic control over strategically important data while simultaneously encouraging technological innovation. This approach acknowledges the legitimate role of governments in protecting national security and critical infrastructure. Nevertheless, broad governmental discretion regarding restrictions on cross-border data transfers may reduce regulatory certainty for foreign investors. Businesses generally favour stable and predictable legal frameworks when making investment decisions, and uncertainty regarding future restrictions may discourage international investment.

South Africa occupies an intermediate position. POPIA establishes a modern privacy framework that is broadly compatible with international standards while avoiding extensive localisation requirements. This relatively balanced approach supports international commerce and promotes foreign investment. However, South Africa’s regulatory framework remains underdeveloped in relation to emerging technologies such as artificial intelligence, cloud computing, and cross-border digital services. Legislative reform may therefore become necessary as technological developments continue to reshape international trade.

A further weakness common to all three jurisdictions is the absence of globally harmonised legal standards governing digital trade. Existing WTO agreements were negotiated before the emergence of the modern digital economy and therefore provide limited guidance regarding issues such as cloud computing, artificial intelligence, algorithmic decision-making, and data localisation. While regional agreements such as the CPTPP and DEPA have introduced more detailed digital trade provisions, their application remains geographically limited.

The lack of harmonisation increases compliance costs, creates legal uncertainty, and may encourage regulatory fragmentation that ultimately undermines international economic integration. Businesses operating across multiple jurisdictions frequently face conflicting legal obligations concerning data storage, transfer mechanisms, cybersecurity standards, and consumer protection requirements. Such fragmentation may inadvertently create barriers to trade contrary to the objectives of international economic cooperation.

From a comparative perspective, none of the three jurisdictions has achieved a perfect balance between privacy protection, national sovereignty, and economic liberalisation. Each model offers valuable lessons while simultaneously revealing significant limitations. Consequently, future legal development should focus upon promoting greater international cooperation rather than encouraging increasingly divergent domestic regulatory approaches.

Recommendations for Reform

The comparative analysis undertaken in this article demonstrates the need for coordinated international reform. While states retain legitimate interests in protecting privacy and national security, excessive regulatory divergence undermines legal certainty and creates unnecessary obstacles to international digital trade.

First, WTO members should accelerate negotiations concerning electronic commerce with the objective of establishing binding multilateral rules governing cross-border data transfers. Updated international standards should clarify the circumstances in which governments may lawfully restrict data flows while preventing protectionist measures disguised as privacy regulation. A predictable legal framework would strengthen investor confidence and promote international economic cooperation.

Second, jurisdictions should adopt interoperable privacy standards based upon common principles rather than identical legislation. Mutual recognition mechanisms similar to the European Union’s adequacy decisions could enable international data transfers where substantially equivalent legal protections exist. Such an approach would preserve national legislative autonomy while reducing unnecessary compliance burdens for multinational enterprises.

Third, South Africa should continue modernising its digital regulatory framework by adopting legislation specifically addressing artificial intelligence, cross-border cloud services, and emerging digital technologies. Clear regulatory guidance would enhance legal certainty while strengthening South Africa’s position within the global digital economy.

Fourth, India should continue balancing digital sovereignty with international economic integration by ensuring that restrictions upon international data transfers remain transparent, proportionate, and consistent with international trade obligations. Predictable regulatory decision-making would encourage foreign investment without compromising legitimate national interests.

Finally, governments should strengthen international cooperation regarding cybersecurity, consumer protection, and digital infrastructure. Effective regulation of digital trade requires collaboration rather than isolation because cyber threats and digital commerce inherently transcend national borders.

Collectively, these reforms would contribute to a more coherent international legal framework capable of supporting innovation, protecting individual rights, and facilitating sustainable economic development.

VII. Conclusion

Digital trade has fundamentally transformed international commerce by making cross-border data flows an essential component of modern economic activity. As governments increasingly regulate personal information to protect privacy, national security, and digital sovereignty, tensions have emerged between domestic regulatory autonomy and the principles of free international trade.

This article has demonstrated that South Africa, India, and the European Union have adopted distinct regulatory approaches reflecting their respective constitutional traditions and policy priorities. The European Union emphasises comprehensive privacy protection through the GDPR; India prioritises digital sovereignty alongside economic development; and South Africa seeks to balance constitutional privacy rights with participation in international commerce through POPIA. Although each framework possesses notable strengths, none fully resolves the legal challenges created by the rapidly evolving digital economy.

The comparative analysis further reveals that fragmented domestic regulation increases compliance costs, reduces legal certainty, and creates barriers to international digital trade. Existing international legal instruments, particularly within the WTO framework, have not kept pace with technological innovation. Consequently, multinational businesses must navigate an increasingly complex network of inconsistent national legal requirements.

This article has argued that greater international harmonisation represents the most effective solution. Rather than imposing uniform legislation, states should cooperate to develop interoperable legal standards that promote cross-border commerce while preserving legitimate public policy objectives. Such an approach would strengthen international trade, encourage technological innovation, and protect individual privacy without unnecessarily restricting global economic integration.

As digital technologies continue to reshape international commerce, legal systems must evolve accordingly. The future of international trade law will depend not only upon technological innovation but also upon the willingness of states to develop cooperative legal frameworks capable of balancing economic opportunity with fundamental rights in an increasingly interconnected world.

References (OSCOLA Style)

Cases

Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems (Case C-311/18) EU:C:2020:559.

Justice KS Puttaswamy (Retd) v Union of India (2017) 10 SCC 1.

Legislation

Constitution of the Republic of South Africa, 1996.

Digital Personal Data Protection Act 2023 (India).

General Data Protection Regulation (EU) 2016/679.

Protection of Personal Information Act 4 of 2013 (South Africa).

International Instruments

Comprehensive and Progressive Agreement for Trans-Pacific Partnership (2018).

Digital Economy Partnership Agreement (2020).

General Agreement on Trade in Services (1994).

Marrakesh Agreement Establishing the World Trade Organization (1994).

Books

Abbott R, The Reasonable Robot: Artificial Intelligence and the Law (Cambridge University Press 2020).

Kuner C, Transborder Data Flows and Data Privacy Law (Oxford University Press 2013).

Journal Articles

Aaronson SA, ‘Data Is Different: Why the World Needs a New Approach to Governing Cross-Border Data Flows’ (2018) CIGI Papers.

Chander A and Lê UP, ‘Data Nationalism’ (2015) 64 Emory Law Journal 677.

Greenleaf G, ‘Global Data Privacy Laws 2024: Despite Challenges, More Than 160 Laws Show Global Convergence’ (2024) Privacy Laws & Business International Report.

Svantesson D, ‘Data Localisation Trends and International Trade Law’ (2022) Journal of International Economic Law.